Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
960 detections
Filters
Last updated
All Time
Detection languages
215
211
197
168
63
Contributors
283
142
113
112
85
Categories
670
218
168
112
95
Platforms
39,908
7,245
6,529
3,864
3,627
960
Products / Services
713
68
64
59
59
MITRE Techniques
310
305
146
136
134
CVEs
5
3
3
2
1
IDS Classtypes
13
11
11
9
8
IDS Protocols
62
1
Detects the attachment or creation of IAM policies that grant administrative access (via 'AdministratorAccess' policy name) or full wildcard permissions ('Action': '*', 'Resource': '*') to users, roles, or groups. This activity is a common indicator of privilege escalation following a cloud identity compromise, frequently observed in campaigns by threat actors such as Scattered Spider (UNC3944).
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
Detects the rapid, bulk launch of GPU-optimized or compute-intensive EC2 instances via API calls such as RunInstances, CreateFleet, or RequestSpotFleet within a short time window. This behavior is often indicative of cloud resource hijacking or cryptojacking, where compromised credentials are used to spin up expensive compute resources for illicit mining or intensive processing.
Detects potential privilege escalation in AWS where a user performs an iam:PassRole action to attach a highly privileged role (e.g., containing 'admin' or 'poweruser' in the name) to a newly created resource (Lambda, EC2 instance, or CloudFormation stack) within a short timeframe. This behavior is a known technique to gain elevated permissions by executing code within the context of a higher-privilege identity.
Detects modifications to AWS EBS or RDS snapshot attributes to grant access to unauthorized or external AWS accounts, or the copying of snapshots to unauthorized accounts, which are common techniques for data exfiltration from cloud environments.
Detects various administrative actions in AWS that result in the disabling, deletion, or suppression of security monitoring services and configurations, including CloudTrail, Security Hub, and AWS Config. This behavior is indicative of an adversary attempting to evade detection by blinding security teams.
Detects anomalous or suspicious creation of AWS IAM access keys, particularly those targeting highly privileged accounts (e.g., 'root') or involving cross-user key generation by non-administrative entities. This behavior is indicative of potential account takeover, persistence establishment, or privilege escalation within the AWS environment.
Detects modifications to AWS S3 bucket permissions or public access block settings that result in publicly accessible buckets. The rule specifically monitors CloudTrail events such as PutBucketAcl, PutBucketPolicy, and PutPublicAccessBlock for configurations that permit AllUsers/AuthenticatedUsers access, overly permissive bucket policies with wildcard principals, or the deactivation of all four block-public-access settings.
Detects potential backdoored persistence in AWS Lambda functions. The rule monitors for two patterns: 1) A Lambda function creation followed by granting cross-account 'lambda:InvokeFunction' permissions to an untrusted or wildcard principal. 2) A privilege escalation event (such as attaching policies) followed by a 'lambda:UpdateFunctionCode' operation on the same function by the same principal, which may indicate an attempt to inject malicious code into a serverless function.
Detects modifications to federated domain authentication, identity provider trusts, or federation settings in cloud environments (e.g., Entra ID, Okta). Unauthorized changes to these configurations can be used to establish persistence, enable SAML token forgery, or bypass Multi-Factor Authentication (MFA).
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
This rule detects modifications to AWS IAM policies (PutUserPolicy, PutRolePolicy, PutGroupPolicy, AttachUserPolicy, AttachRolePolicy, or CreatePolicyVersion) that result in a policy granting administrative '*' access to both Actions and Resources. This pattern is commonly used by adversaries for persistence and privilege escalation after initial IAM credential compromise.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
This rule detects modifications to AWS EC2 Snapshot or AMI (Image) attributes that result in the resource becoming publicly accessible ('all') or shared with an unapproved AWS account ID. Such activities are often precursors to data exfiltration or unauthorized access to sensitive disk images.
Page 9 of 46